Re: Google open redirect

[Michal Zalewski <lcamtuf () coredump cx>]

> For example: did you know that if you click on a link from coredump.cx
> to microsoft.com and it opens in a new window, then a second or two
> later, that coredump.cx in the background can change the URL of the
> microsoft.com window, and point it to evil.com? Heck, coredump.cx can
> even wait until you navigate further down the microsoft.com website -
> and detect that event programmatically. That behavior is enshrined
> within the current design of the same-origin policy, and browser
> vendors seem hesitant to touch it.

Here's a tiny PoC:
http://lcamtuf.coredump.cx/switch/

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/